MVP, Author

Authorization Filters in ASP.NET Web API 2

Hits: 2009

In this post we will focus on securing the ASP.Net Web Api2 using Authorization Filter, before step into that let’s shortly discus about Web API.


Application Programming Interface (API) is a platform that help makes to build HTTP service accessed by different application interfaces, also known as Representational State Transfer (REST) Service for networked application.

HTTP Methods in Web API: Http is all about to create a request & getting server response that correspond four HTTP methods.

  • C – Create – POST
  • R – Read – GET
  • U – Update – PUT
  • D – Delete – DELETE

Example request:

Example response:

Types of HTTP Status Codes:

  • 1XX Codes: Informational codes. Rarely used in modern web apps.
  • 2XX Codes: Success codes. Tells the client that the request succeeded.
  • 3XX Codes: Redirect codes. Tells the client that they may need to redirect to another location.
  • 4XX Codes: Client Error codes. Tells the client that something was wrong with what it sent to the server.
  • 5XX Codes: Server Error codes. Tells the client that something went wrong on the server’s side, so that the client may attempt the request again, possibly at a later time.

HTTP Status Codes:

  • 200 – OK
  • 204 – No Content
  • 304 – Not Modified
  • 400 – Bad Request
  • 401 – Unauthorized
  • 404 – Not Found
  • 500 – Internal Server Error
  • 501 – Not Implemented

Now let’s get back to security issue while using ASP.Net Web Api2. It is important to restrict un-authorized access of particular operation/action of application. This has experimented while i was working on a project that needed to restrict un-authorized person to perform crud operations. The authorization is based on user role.

OK, Let’s get started, here’s the steps hope you will enjoy it.


  • SQL Database
    • Create new Database
    • Run the db-script
  • ASP.Net Mvc Application(Web Api)
    • MVC, WebApi Project
    • Install AngularJS
    • Authentication &
    • Authorization

Create New Database

After creating the database let’s download & run the script. Let’s create a new MVC application

MVC Application


Install the AngularJS for clientside scripting from nuget package installer.


First we need to login for authentication check


Authentication & Authorization: 

  • Authentication : identity of the user.
  • Authorization : allowed to perform an action.

After successfully login(Authentication) we can access the get customer link to show all the customer, only if we have the read permission in database.


In our database table we have restrict the access (CanRead to “False”) of Administrator to view customer list.


The result will show 401 response message while fetching data from database where logged user role is administrator.


Using the code

Here’s our api Controller  that is restrict by using [BasicAuthorization] attribute at the top of the CRUD methods.

Below code snippet of our Custome Attribute which  is inherited from AuthorizationFilterAttributeusing System.Web.Http.Filters. Targeted to both class and method, if you want target only  method then remove the AttributeTargets Class tagated attributes with the or oerator.

Here OnAuthorization is a method that override from inherited class, calls when a process requests for authorization & filterContext is parameter which encapsulates information for using System.Web.Http.Filters.AuthorizationFilterAttribute

In this section exception is handled by sending response of Forbidden (403) & Unauthorized (401) of response code.

Script for Token Generation

Below is angularJS script for token generation at client end, while each request is process, this is generated first and send it along with request header to validate.

Token is generated by Base64-encode, where the hash has the message body & the encryption key, in this app we have use crud type as key.

Server Token Generation

The way which the client token was generated we need to re-generate the token according to the same way, which will compare & validate whether the request is fake?

Validate Token

This part of code will compare & validate the request in two step, first token is compared and it will validate the authorization from database of access the crud operations.


This sample of code will validate the access permission from database on each action.

Source Code: I’ve uploaded the full source code to download/clone @github, Hope this will help 🙂


  • Reply monir hossain |

    Useful article. But I didn’t understand token and BasicAuthorizatoin class properly. It would be better if I got a bit detail explanation. Thanks anyway.

Post a comment